fix for Mavericks/new-webkit

Putting the user/pass into the URL no longer works, so we just set our
own Authorization header on the XHR.

This emulates the wget --auth-no-challenge behavior that is now
necessary for basic auth to the feed to work.